name: Dependency hygiene

# GitHub Actions is public mirror validation only.
# Primary registry release evidence must be produced on Russian build-runner.

on:
  push:
  pull_request:
  workflow_dispatch:
  schedule:
    - cron: "17 2 * * 1"

permissions:
  contents: read
  pull-requests: read

jobs:
  unused-dependencies:
    name: Unused dependency check
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: adk-rust
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-machete
        run: cargo install cargo-machete --locked

      - name: cargo metadata
        run: cargo metadata --locked --format-version 1 > /tmp/aw-rus-cargo-metadata.json

      - name: cargo machete
        run: cargo machete --with-metadata

      - name: Ensure cargo-machete metadata did not rewrite manifests
        working-directory: .
        run: git diff --exit-code -- adk-rust/Cargo.lock adk-rust/Cargo.toml adk-rust/crates

      - name: Require explicit justification for cargo-machete ignores
        working-directory: .
        run: |
          python3 - <<'PY'
          from pathlib import Path

          failures = []
          for path in Path("adk-rust").rglob("Cargo.toml"):
              lines = path.read_text(encoding="utf-8").splitlines()
              in_machete = False
              for idx, line in enumerate(lines):
                  stripped = line.strip()
                  if stripped.startswith("[") and stripped.endswith("]"):
                      in_machete = stripped == "[package.metadata.cargo-machete]"
                      continue
                  if not in_machete or not stripped.startswith("ignored"):
                      continue
                  same_line_comment = "#" in line and line.split("#", 1)[1].strip()
                  prev_comment = idx > 0 and lines[idx - 1].strip().startswith("#")
                  if not same_line_comment and not prev_comment:
                      failures.append(f"{path}:{idx + 1}")

          if failures:
              print("cargo-machete ignored entries require an adjacent TOML comment explaining why the dependency is intentionally kept:")
              for item in failures:
                  print(f"  {item}")
              raise SystemExit(1)
          PY

  dependency-tree:
    name: Dependency duplicate report
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
        working-directory: adk-rust
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@stable

      - name: cargo tree duplicates
        run: cargo tree --duplicates --locked

  dependency-security:
    name: Dependency security policy
    runs-on: ubuntu-latest
    defaults:
      run:
        shell: bash
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Install stable Rust
        uses: dtolnay/rust-toolchain@stable

      - name: Install cargo-audit
        uses: taiki-e/install-action@cargo-audit

      - name: Install cargo-deny
        uses: taiki-e/install-action@cargo-deny

      - name: cargo audit
        working-directory: adk-rust
        run: cargo audit --deny warnings

      - name: cargo deny
        run: |
          cargo deny --manifest-path adk-rust/Cargo.toml check \
            --config deny.toml \
            --hide-inclusion-graph \
            --show-stats

  cargo-udeps-nightly:
    name: Cargo udeps nightly advisory
    runs-on: ubuntu-latest
    continue-on-error: true
    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
    defaults:
      run:
        shell: bash
        working-directory: adk-rust
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          lfs: false

      - name: Install nightly Rust
        uses: dtolnay/rust-toolchain@nightly

      - name: Install cargo-udeps
        run: cargo install cargo-udeps --locked

      - name: cargo udeps
        run: cargo +nightly udeps --workspace --all-targets